The Patching Friars' AlmanacA calendar of CVE saints

May 28

Click or TrickHoly card for click-or-trick, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 Click or Trick UNO ICTU EVASIT
🤖 Image and text generated with AI

⬇ Download holy card: ·

⚔ Commemorated today: The Scourge of the Flame (2012)

Embed on your site

Saint Click-or-Trick, Who Escaped With a Click

Patron of low-integrity processes, links that open other apps, and anyone who clicks before reading.

Life

On 28 May 2026 SafeBreach Labs told the story of Click or Trick, CVE-2025-59199, a flaw in the Windows Software Protection Platform that Microsoft fixed on 14 October 2025. By combining COM server activation with the way Windows handles application URIs, a process confined to low integrity could, with a single click from the user, write files and get code running at medium integrity. A treat for attackers, a trick on the sandbox.

Prayer

O Saint Click-or-Trick, who hopped from app to app, let every link take us only where we mean to go. Amen.

How to celebrate

Celebrated by installing Windows' October 2025 cumulative updates and not treating a click as consent.

Click without a thought, and the sandbox walls are naught.

Technical record

Disclosed on
May 28 2026
CVE
CVE-2025-59199
CVSS
7.8
Product
Microsoft · Windows 10 Version 1809

Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.

Sources: safebreach.com

Commemorated today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.